CVE-2026-98123: Linux Kernel SCTP DoS Vulnerability

CVE-2026-98123 Overview

CVE-2026-98123 is a remote denial-of-service vulnerability in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. The flaw stems from inconsistent parameter walking between sctp_verify_asconf() and sctp_get_asconf_response() when processing ASCONF-ACK chunks. One function advances by SCTP_PAD4(length) while the consumer advances by the raw length, allowing an attacker-controlled odd-length parameter to desynchronize the two walks. A crafted ASCONF-ACK can cause an infinite loop in softirq context, triggering a watchdog soft lockup. The vulnerability was reported by ZeroHive, a vulnerability hunting agent at Tencent Yunding Lab.

Critical Impact
A remote peer on an ADD-IP enabled SCTP association can send a single crafted ASCONF-ACK chunk to spin a CPU indefinitely in softirq context, causing a kernel soft lockup and denial of service.

Affected Products

Linux kernel SCTP subsystem with ADD-IP (RFC 5061) support enabled
Stable kernel branches prior to the fixes in commits 2cb0b0b1, 3be02999, 7ba84e29, and abf59d7f
Distributions shipping affected upstream SCTP code

Discovery Timeline

2026-09-25 - CVE-2026-98123 published to NVD
2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-98123

Vulnerability Analysis

The defect lives in the SCTP ADD-IP extension handling. sctp_verify_asconf() iterates ASCONF-ACK parameters using sctp_walk_params(), which rounds each parameter length up to a 4-byte boundary via SCTP_PAD4(length). The downstream consumer sctp_get_asconf_response() walks the same buffer but advances by the raw, unpadded length field. A single odd-length parameter desynchronizes the two walks.

Once desynchronized, the consumer interprets attacker-controlled bytes at a misaligned offset as the next parameter header. When those bytes decode to a length of zero, the while loop over asconf_ack_len makes no forward progress and spins forever inside softirq context. The CPU watchdog then reports a soft lockup. All reads remain inside the received socket buffer, so the issue is a pure remote denial-of-service rather than memory corruption.

A secondary out-of-bounds read exists in the SCTP_PARAM_ERR_CAUSE branch. The verifier performs no length check, so a parameter shorter than sizeof(struct sctp_addip_param) + sizeof(struct sctp_errhdr) can reach the consumer, which then reads errhdr.cause past the end of the parameter.

Root Cause

Two iterators over the same byte sequence apply different advancement rules. The verifier uses 4-byte padded lengths; the consumer uses raw lengths. RFC 5061 permits odd parameter lengths for SCTP_PARAM_ERR_CAUSE, so even conforming peers can expose the mismatch. The verifier also lacks a minimum-length check for SCTP_PARAM_ERR_CAUSE parameters, enabling the out-of-bounds read of the error cause header.

Attack Vector

An attacker establishes or participates in an SCTP association that has negotiated the ADD-IP extension and has an outstanding ASCONF. The attacker then sends a crafted ASCONF-ACK containing an odd-length parameter followed by bytes that decode to a zero-length header at the misaligned offset. RFC 5061 section 4.1.2 requires the chunk to be authenticated, but the predefined empty key id 0 allows the peer to compute the same association HMAC from publicly exchanged parameters, so authentication does not block exploitation. Processing occurs in softirq context, so the affected CPU becomes unresponsive and the kernel watchdog fires.

No verified exploit code is published. Refer to the upstream commits linked under Patch Information for the exact fix and reproducer context.

Detection Methods for CVE-2026-98123

Indicators of Compromise

Kernel log entries reporting watchdog: BUG: soft lockup - CPU#X stuck with stack traces including sctp_get_asconf_response, sctp_process_asconf_ack, or sctp_sf_do_asconf_ack.
Unexpected high CPU utilization pinned to a single core while the system handles SCTP traffic.
Receipt of ASCONF-ACK chunks on associations where ADD-IP was negotiated, correlated with the soft-lockup timestamp.

Detection Strategies

Monitor dmesg and /var/log/messages for soft lockup traces originating in the SCTP stack.
Capture SCTP traffic with tcpdump or tshark and inspect ASCONF-ACK chunks for parameters with odd length fields or SCTP_PARAM_ERR_CAUSE entries shorter than the combined sctp_addip_param and sctp_errhdr size.
Alert on repeated kernel softirq watchdog events on hosts running telephony, SIGTRAN, or other SCTP-dependent workloads.

Monitoring Recommendations

Enable kernel crash collection (kdump) to preserve stack traces for post-incident analysis.
Track per-CPU softirq time via node_exporter or equivalent to surface stalls early.
Inventory hosts with the sctp module loaded using lsmod | grep sctp and prioritize those exposed to untrusted peers.

How to Mitigate CVE-2026-98123

Immediate Actions Required

Apply the upstream kernel updates containing commits 2cb0b0b1, 3be02999, 7ba84e29, and abf59d7f as soon as distribution builds become available.
Restrict SCTP exposure at the network perimeter to known, trusted peers using firewall rules on IP protocol 132.
Audit workloads that rely on SCTP (Diameter, SIGTRAN, WebRTC data channels) and schedule prioritized patch windows.

Patch Information

The fix rejects SCTP_PARAM_ERR_CAUSE parameters shorter than sizeof(struct sctp_addip_param) + sizeof(struct sctp_errhdr) at the verifier, guaranteeing a complete error header before the consumer runs. It also aligns the consumer iterator with the verifier's SCTP_PAD4 padding rule, keeping the two walks in lockstep. The consumer's asconf_ack_len guard is removed because the verifier now enforces the invariant, and the consumer returns err_param->cause directly. Patch references are available at the kernel.org commits listed above.

Workarounds

Unload the SCTP module where it is not required: modprobe -r sctp and blacklist it in /etc/modprobe.d/.
Disable the ADD-IP extension on SCTP sockets or set the net.sctp.addip_enable sysctl to 0 where feasible.
Enforce strict peer allowlists on SCTP endpoints and require properly keyed SCTP-AUTH with non-default keys.

bash

# Disable the SCTP ADD-IP extension and block the module where unused
sysctl -w net.sctp.addip_enable=0
echo "install sctp /bin/true" | sudo tee /etc/modprobe.d/disable-sctp.conf